SB2026111088 - Multiple vulnerabilities in Primavera Unifier

Description

This security bulletin contains information about 10 vulnerabilities.

1) Path traversal (CVE-ID: CVE-2026-78254)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to overwrite arbitrary files.

The vulnerability exists due to path traversal in the ftp and scp tasks when processing files downloaded from a malicious server. A remote attacker can provide relative paths to write files outside the dedicated download target directory.

For scp and FTPS, the server must pass the tasks' server identity checks; non-FTPS FTP connections may be subject to a machine-in-the-middle attack.

2) Deserialization of Untrusted Data (CVE-ID: CVE-2026-41855)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform unauthorized actions.

The vulnerability exists due to unsafe deserialization in org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter when processing messages in an untrusted JMS environment. A remote attacker can send a crafted message to perform unauthorized actions.

Exploitation can lead to arbitrary class instantiation through gadget class deserialization.

3) Improper Output Neutralization for Logs (CVE-ID: CVE-2026-84501)

CWE-ID: CWE-117 - Improper Output Neutralization for Logs

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to forge operational log entries.

The vulnerability exists due to improper output neutralization for logs in EnsembleAuthenticationProvider.handleAuthentication() when processing a crafted add_auth("ensemble", ...) request containing newline characters. A remote attacker can send a crafted authentication request to forge operational log entries.

Forged entries can include arbitrary timestamps, log levels, class names, and messages that appear visually indistinguishable from genuine ZooKeeper log output.

4) Improper input validation (CVE-ID: CVE-2026-49844)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Core (Apache Log4j) component in Oracle Communications Unified Assurance. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

5) Resource exhaustion (CVE-ID: CVE-2026-66144)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper resource control in the remote PolicyReference retrieval API when manually retrieving remote policy references. A remote user can retrieve a huge remote policy to cause a denial of service.

Remote policy references are not retrieved during policy normalization.

6) Improper input validation (CVE-ID: CVE-2026-101475)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Logging component in Primavera Unifier. A remote authenticated user can exploit this vulnerability to gain access to sensitive information.

7) Improper input validation (CVE-ID: CVE-2026-101735)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Project Control component in Primavera Unifier. A remote authenticated user can exploit this vulnerability to read and manipulate data.

8) Improper input validation (CVE-ID: CVE-2026-101736)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Core component in Primavera Unifier. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

9) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-75140)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the XmlTreeBuilder namespace scope tracking when parsing untrusted XML input. A remote attacker can supply a deeply nested XML document with uniquely named namespace declarations to cause a denial of service.

Parsing documents with many nested namespace bindings grows quadratically in time and retained memory.

10) Resource exhaustion (CVE-ID: CVE-2026-68497)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in CoreXMLDeserializers when deserializing JSON string values into javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar fields. A remote attacker can send a specially crafted request to cause a denial of service.

The issue is reachable with the default mapper configuration and does not require polymorphic typing or special configuration.

Remediation

Install update from vendor's website.

References

• https://www.oracle.com/security-alerts/cpuoct2026.html